Citadel voice deepfake — Oct 2026

In August 2026, major Wall Street financial firms and hedge funds, including Citadel, Millennium Management, and Point72 Asset Management, were targeted by sophisticated vishing attacks. Threat actors utilized voice cloning technology to impersonate employees in an attempt to bypass security protocols and gain unauthorized access to sensitive information.

What happened

The attackers targeted the help desks of these financial institutions, leveraging the urgency typically associated with password reset and MFA re-enrollment requests. By using high-quality voice clones, the threat actors posed as legitimate employees to convince help desk staff to reset credentials. This method exploits the human tendency to trust familiar voices and the pressure help desk personnel face to resolve access issues quickly. While several of the targeted firms confirmed that no customer data was stolen during these incidents, the attacks underscore the increasing vulnerability of traditional help desk authentication processes to AI-driven social engineering. The incident highlights that password resets function as a master key to business systems, making them a primary target for attackers who can successfully mimic an employee's voice.